How marine insurers are plugging the gap in cyber attack cover

The rising threat of cyber attacks on an increasingly connected global shipping fleet has been recognised, with insurers drawing up maritime-specific plans.

Cyber cover has traditionally been excluded from standard hull and machinery contracts, but specialist insurers and some protection and indemnity clubs have looked to fill the gap in the market.

Here are the ports and shipping companies impacted by the global CrowdStrike software outage

Read more

They include P&I clubs like the West of England, which has invested in marine cyber insurance specialist Astaara, Steamship and the Swedish Club, which signed up all its members to an initial trial membership of a $50m facility this year.

But it remains a complex area of risk for shipping companies, with attacks potentially escalating rapidly if hackers infiltrate an entire company’s fleet.

The blurring of the lines between criminals and state-backed actors can also have a major impact and could result in claims being made under either war or cyber policies.

Tord Nilsson, the Swedish club’s area manager for the UK and head of reinsurance, described its policy as a starting point for shipping, which has lagged other industries because of a perception of limited risk and a lack of suitable products in the market.

But with advances in technology, including shore-based monitoring of onboard equipment and demands from seafarers for full online connectivity to maritime satellite services, has come a growing recognition of a potential threat.

Israeli security company CyWhale told TradeWinds that a ship’s systems can be infiltrated during the daily downloading of charts.

It has demonstrated how an embittered employee or corrupt insider using basic equipment could infect a ship’s systems, which could then spread to shore-based networks. The Swedish Club’s more advanced policies include requiring shipping firms to have security procedures in place for downloading charts, along with other assurances over crew training and backups for onboard systems.

In August, the International Maritime Organization published a 12-page guide on measures to limit opportunities for terrorists and criminals to exploit vulnerabilities to break into protected areas and systems.

P&I clubs already provide cover for third-party claims for cyber attacks, although those claims are capped across the entire membership.

But most ships will not be covered by hull insurance if a cyber attack causes a ship to run aground or sink because location equipment has been tampered with.

“We realise that there are lots of shipowners out there who have borrowed money to buy vessels or who have a lot of money invested in their vessels,” Nilsson said.

Shipowners join newbuilding dash as costly cyber rules loom

Read more

“And at the moment, they have no cover for physical damage following cyber attack, because it is excluded.

“We were looking to try to provide cover for a very long time, but the feeling was that the cyber market didn’t understand the marine market.”

Cyber insurance with the Swedish Club starts from a few hundred dollars for its basic package.

“There are lots of shipowners out there who have lots of knowledge of cyber resilience, but there are also many that have not yet been thinking that much about it,” Nilsson said.